You are here

Virgin Media: ports 3128 and 8080

Posted by Andy Langton on Sunday, 18 January 2015

Every now and then I use a port scanner on computers I work with to check which services are accepting connections from the internet. For a typical client PC, there should normally be no ports accessible, and for a server, only those ports specifically enabled for services.

Imagine my surprise when scanning a server recently to notice that in addition to the ports specifically open, also open were port 8080 and port 3128. Both are ports commonly used by HTTP proxies, and as a result also commonly used by trojans. So, into trojan scanning mode I went only to find nothing. I also checked the router, which was blocking connections to those ports, and the software firewall which also had no rules that would enable these connections. So was it some kind of uber-stealth trojan?

After a lot of hassle and some amount of worry, it dawned on me that if there was genuinely no program listening on those ports, it must be at the ISP level. Virgin Media was probably opening these ports (and if you ask me, exposing their clients to unnecessary attention from hackers scanning for vulnerabilities.

With a bit of Googling, I found a number of references to those ports as being part of a web caching system in use by Virgin Media (see http://ben.cheetham.me.uk/resources/net/ntl-proxy-list, for example). Bah. Curse you Virgin! For anyone else curious about these open ports on a Virgin Media connected computer, hopefully this post will save you the time I just spent ;)